Module: Mbeditor::ChannelAuthentication

Included in:
CollaborationChannel, EditorChannel
Defined in:
app/channels/mbeditor/channel_authentication.rb

Overview

Runs the configured authenticate_with hook on the WebSocket handshake (at channel subscribe) and rejects the subscription when it denies. This is the same proc the engine runs as a controller before_action; on the cable side there is no controller, so it is evaluated against a probe that mirrors the surface the hook relies on (session, cookies, redirect_to/render/ head). A hook that halts — or raises — denies the socket (fail-closed).

The probe reads cookies/session from the upgrade request env when available; because the cable mount can bypass host middleware, hooks that depend on request-scoped state may see less than they do over HTTP. Restricting network exposure (trusted tunnel / LAN) and securing the host's ActionCable connection remain the primary controls — see the README pairing section.

Defined Under Namespace

Classes: AuthProbe

Instance Method Summary collapse

Instance Method Details

#mbeditor_authenticated? ⇒ Boolean

True when the connection is allowed (or no hook is configured); otherwise rejects the subscription and returns false.

Returns:

  • (Boolean) 


21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'app/channels/mbeditor/channel_authentication.rb', line 21

def mbeditor_authenticated?
  hook = Mbeditor.configuration.authenticate_with
  return true unless hook

  probe = AuthProbe.new(mbeditor_connection_env)
  probe.instance_exec(&hook)
  return true unless probe.denied?

  mbeditor_reject_subscription
  false
rescue StandardError
  mbeditor_reject_subscription
  false
end